1. Field of the Invention
The present invention relates to the field of domain names, as used on the Internet and the World Wide Web. More particularly, the invention relates to the security of the domain name system.
2. Related Art
The Domain Name System (DNS) protocol has a long history of vulnerabilities and there have been a myriad of threats to the global DNS infrastructure for many years. The most prevalent threats have been Distributed Denial of Service (DDoS) attacks and cache poisoning attacks. Most conventional attack vectors have had reasonably simple solutions to prevent or mitigate these attacks.
Recently, Dan Kaminsky of Doxpara Research discovered a long latent combination of flaws in the DNS protocol that allows an attacker to poison any DNS resolver cache for any zone or resource record in the cache in a matter of seconds (for a detailed description of the flaw see the following: http://www.unixwiz.net/techtips/iguide-kaminsky-dns-vuln.html). In summary, an attacker makes a DNS query against a recursive resolver, which then forwards the query to the appropriate authoritative DNS server. The attacker then floods the recursive server with poisoned answers, posing as the authoritative server (spoofing) and exploiting the combination of flaws that Kaminsky discovered to win the race against the “true” answer from the authoritative server.
In response to this new vulnerability, vendors collaborated together with Dan Kaminsky and other industry experts on a plan to patch the flaw, and simultaneously released the patch on Jul. 8, 2008. The patch was believed to sufficiently increase the complexity of exploiting this flaw, giving the industry time to deploy DNS Security Extensions (DNSSEC), which most experts believe is the ultimate solution to DNS security problems.
However, on Aug. 8, 2008, a group of researchers from the Russian Federation discovered that a well crafted attack against fully patched resolvers could still succeed in approximately 10 hours. Dan Kaminsky commented on this revelation in his blog: “What was once possible via 32,769 packets, is still possible via between 134,217,728 and 4,294,967,296 packets.”
Adding to the severity of the problem, approximately one week after the Russian report, a major Internet service provider (ISP) found over 100 fully patched, recursive DNS servers within their infrastructure that had been “brute force” poisoned for a very popular web site visited by Internet Relay Chat (IRC) users. The patch that experts previously believed would provide enough time to get DNSSEC deployed literally provided the industry just a few extra weeks.
Some experts believed that utilizing Hypertext Transfer Protocol over Secure Sockets Layer (HTTPS) was a means to protect DNS as the Secure Sockets Layer (SSL) certificate has to be generated by a known certificate provider. However, the nature of the flaw allows e-mail messages to be intercepted and forged, thus making it possible for anyone to register a certificate, for example, www.amazon.com, and some certificate providers only require e-mail messages to the owner of the domain to be confirmed. With a newly generated and valid certificate, HTTPS does not protect a company from this flaw.